Looking to put the below string in between quotes for a json key value pair.
index=xyz_* sourcetype=abc_* /api/v2/abc/words/process/ \"status\":\"timeout\" OR \"status\":\"finished\"
| rex field=_raw "\"status\":\"(?<process_status>.{9})"
| stats count by process_status
Also is there a website or tool that does this? How to learn this kind?
